[a_d_13]

Slides from Microsoft.

Alureon: The First In The Wild 64-Bit Windows Rootkit http://www.virusbtn.com/pdf/conference_ ... VB2010.pdf

Can anyone else download those slides? I get an error when downloading (using IE, FF, Chrome, and wget). If you can download, please upload them here :)

Thanks,
--AD

[SecConnex]

Here we go, AD. :)

Too big to attach.

mediafire.com /?jot8my6v4sa3cbh

[gjf]

Have you are. This is the same slides but renamed pdf. Let me know if you cannot download it again.

[a_d_13]

Thank you, DragonMaster Jay and gjf. I especially liked this bit of the presentation:



;)

Thanks,
--AD

[Blur]

Finally a normal article, without any stupid "IoCreateDriver" stuff etc... Everything looks clear now.

[4r0]

And those samples? TDSS x64 too (both of them)?

[EP_X0FF]

Yes.

bdesvr.zip

[main]
version=0.03
aid=30020
sid=0
builddate=4096
rnd=1770027372
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://kangojim1.com/;hxxps://lkaturi71.com/;hxxps://rukkeianno.in/;hxxps://neywrika.in/;hxxps://86b6b6b6.com/
wsrv=hxxp://rudolfdisney.com/;hxxp://crozybanner.com/;hxxp://imagemonstar.com/;hxxp://funimgpixson.com/;hxxp://bunnylandisney.com/
psrv=hxxp://cri71ki813ck.com/
version=0.15

load.zip

[main]
version=0.03
aid=40583
sid=0
builddate=4096
rnd=1202660629
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://nichtadden.in/;hxxps://li1i16b0.com/;hxxps://zz87jhfda88.com/;hxxps://n16fa53.com/;hxxps://01n02n4cx00.cc/;hxxps://lj1i16b0.com/
wsrv=hxxp://clikcpixelabn.com/;hxxp://thinksn0taeg.com/;hxxp://jimgwarehouse.com/;hxxp://getbestbaner.com/;hxxp://pixelratator.com/
psrv=hxxp://clkh71yhks66.com/
version=0.15

Same buggy stuff, nothing new.

[Blur]

Hm, I've checked this sample on 3 vms. It seems to be incompatible with cracked win7 (yes i use cracked windows on my vmwares :) oh c'mon). The only way to boot in that case is to use f8->disable driver signing... Epx0ff are you using cracked windows hehe :)

[gjf]

Hm, I've checked this sample on 3 vms. It seems to be incompatible with cracked win7 (yes i use cracked windows on my vmwares :) oh c'mon). The only way to boot in that case is to use f8->disable driver signing... Epx0ff are you using cracked windows hehe :)

What is the way to crack? I believe there was a simple conflict because of similar booting stage patching.

[EP_X0FF]

Epx0ff are you using cracked windows hehe :)

Both samples were analyzed under clean Windows XP SP3 x86 licensed copy.
This bootkit renders XP and 2003 to be unbootable in all cases.
However second sample failed to infect mbr and died after reboot.
x64 Windows 7 well infected and working after reboot (in my case).

edit:
of course every time before infecting machine, disk image restored from clean copy.